☕️ Cloudflare reclaims 100 TB of RAM

• Cloudflare freed more than 100 TB of RAM across its internal load balancer by optimizing the Rust consistent-hashing implementation in pingora-ketama, which the Pingora Backend Router uses to spread cacheable requests across backend servers.
• Applying probability theory to find the minimum hash points needed, the team cut hashes per backend by about 90% without losing distribution accuracy, and shrank each stored entry from 8 bytes to 6 since the hash and server index fit in that space.
• Because swapping the hash ring reroutes cached requests and could flood origins with traffic, Cloudflare rolled the new ring out gradually alongside the old one to limit cache churn.

• Moonshot deliberately stripped offensive-cyber data from Kimi K3.1 Pro, an open-weight model unveiled on October 24, to limit its hacking abilities while keeping general coding intact, as fears grow that capable AI makes cyberattacks cheaper to automate.
• The curbed model scored 81% on Moonshot's internal benchmark for finding and exploiting vulnerabilities, versus 90.5% for an unrestricted version, a drop the company hasn't had independently verified, though it still reportedly beats its predecessor.
• Weights ship on November 4 for the roughly 3-trillion-parameter model, which carries a one-million-token context window and a Highspeed variant running two to three times faster; once distributed, Moonshot loses control over whether its safeguards hold.

• GitHub Actions now offers workflow dependency lockfiles in public preview, letting you pin actions and reusable workflows to exact commits while keeping readable tag or branch references in your workflow files.
• A GitHub CLI extension generates and maintains lockfiles covering actions, their transitive dependencies, and reusable workflows; once a workflow is onboarded, Actions runs the recorded commits even if a tag or branch moves afterward.
• This protects against moved tags or branches injecting malicious code, but locking doesn't vet whether a dependency is safe, so review before locking; Dependabot regenerates matching lockfile entries in its update pull requests.

• Microsoft shipped the stable 2.0 release of the official MCP C# SDK, implementing the latest Model Context Protocol spec and making Streamable HTTP servers stateless by default so any instance can handle any request.
• Protocol version and capabilities now ride with every request, dropping the handshake and session stickiness, while standardised headers let load balancers route MCP traffic without reading the body, which stays authoritative on mismatch.
• Stateful-only paths and legacy SSE endpoints now raise warnings, mid-call input moves to Multi Round-Trip Requests, and stable 1.x APIs keep working except Tasks, which moved to an opt-in package incompatible with the earlier experimental version.

• Tamagui 3 shipped with a C++ native style runtime that pushes theme and style updates straight to eligible Fabric views without re-rendering the React components that use them.
• The runtime is an opt-in beta requiring React Native 0.82 or newer on the New Architecture, and an improved compiler now handles conditionals, nested ternaries, static spreads, and build-time variants to flatten more components to plain views.
• Flat style props merge each property's base value and conditions into one Tailwind-style clause, but their full type space exceeds a million union members, so completions, diagnostics, and hover moved to a Rust LSP binary serving Neovim, Zed, JetBrains, and VS Code.

📚 Tutorials & Advice

🔗 Other News & Articles

• Origin range requests: Serving large files without range-request tuning LINK

• PHP Foundation's lone full-timer faces twice the code proposals on $974K a year LINK

• ‘Tokens Are Cheap’: Open Source Subreddit Bans AI LINK

• stencil-hq/dquickts: QuickJS with durable execution: suspend running JS, snapshot the whole heap, resume it in another process. Native TypeScript, a REPL that survives restarts, Rust bindings. LINK

• Google's C Binder Driver Removed With Rust Binder Ready For "Few Billion Devices" LINK

• Modder turns NES into a Windows-like desktop with original hardware LINK

• Nvidia RTX 20, 30, and 40-series GPUs hacked to remove a half-speed AI throttle LINK

📄 Papers & Resources

🧰 Latest Tools

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!